Overview
The default binary is kite (all-in-one); the lean editions — kitecmd (base only), kitecloud (base + Kubernetes), kiteai (base + MCP) — are subsets for space-conscious targets. Every command works in any edition that includes the modules it touches; edition-specific commands are flagged below.
Examples use kite; substitute kitecmd/kitecloud/kiteai for the lean editions.
Commands¶
Script execution¶
Available in every edition (base, cloud, ai, all).
| Command | Purpose |
|---|---|
kite run |
Execute a starkite script |
kite exec |
Execute inline Starlark code |
kite repl |
Start an interactive Read-Eval-Print-Loop (REPL) |
kite watch |
Watch and re-execute script on file changes |
kite test |
Run test functions in _test.star files |
kite validate |
Validate script syntax without executing |
kite init |
Scaffold a new starkite module |
Maintenance¶
Available in every edition.
| Command | Purpose |
|---|---|
kite version |
Print version information |
kite update |
Update starkite to the latest version |
kite module |
Manage external modules |
Cloud commands¶
Available in kite (all-in-one) and kitecloud.
| Command | Purpose |
|---|---|
kite kube |
Kubernetes artifact generation (gen-controller-artifacts, gen-webhook-artifacts) |
Global Flags¶
| Flag | Description | Default |
|---|---|---|
--var key=value |
Set a script variable | |
--var-file path |
Load variables from YAML file | |
--output format |
Output format: text, json, yaml, table | text |
--debug |
Enable debug logging | false |
--dry-run |
Preview commands without executing | false |
--timeout seconds |
Script execution timeout | 300 |
--permissions name |
Permission profile name: a built-in (deny-all/allow-fs/allow-net/allow-local/allow-all) or a profile defined in config.yaml; unset resolves to the config default profile or deny-all |
"" |
--deny-all, --allow-fs, --allow-net, --allow-local, --allow-all |
Boolean aliases for --permissions=<profile>. Set at most one; not combinable with --permissions |
false |
--sandboxed |
Enable OS-level sandbox isolation using the default profile. See Sandbox guide. |
false |
--sandbox-profile name |
Sandbox profile name: a built-in rung (opaque/net-access/host) or a config.yaml profile. |
"" |
--sandbox-driver driver |
Sandbox execution driver (auto/landlock/seatbelt/podman/docker/nerdctl/gvisor). Overrides driver in profile. |
"" |
--sandbox-opaque, --sandbox-net, --sandbox-net-access, --sandbox-host |
Boolean shortcuts for --sandbox-profile=<rung>. |
false |
Environment Variables¶
| Variable | Description |
|---|---|
STARKITE_DEBUG |
Set to 1 or true to enable debug mode |
STARKITE_OUTPUT |
Default output format |
STARKITE_TIMEOUT |
Default timeout in seconds |
STARKITE_VAR_* |
Variable injection (e.g., STARKITE_VAR_DB_HOST=localhost → var_str("db.host")) |
STARKITE_SANDBOX_PROFILE |
Sandbox profile for shebang-launched scripts (same syntax as --sandbox-profile). |
STARKITE_SANDBOX_DRIVER |
Sandbox execution driver override (auto, landlock, seatbelt, podman, docker, nerdctl, gvisor). |